Sessions can now start in a sandbox VM by default when an option is set. The new --unsandboxed flag opts out of that and of cloud-by-default too. Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH turns on the send-file tool and stops Claude Code uploading the files it sends you. On self-hosted runners, all session traffic can now go through a proxy you run. Admins get a beta selfHosted section in managed settings for self-hosted session hosts. A new codeAllowedRepositories setting lists the git repositories Claude Code may work in on those hosts.
Claude Code is now listed as a reader of organization-managed settings, but those settings are not served to it yet. Organization config also gains an Allow Quick Write setting that is not switched on. Claude Desktop accepts codeAllowedRepositories but does not apply it to on-device sessions yet. The memory dialog has a new cloud memory option that does nothing yet. A new check for one tool in a permission mode called arbiter stays off unless the server turns it on.
An MCP tool whose parameter description the API rejects no longer breaks the conversation. Claude Code now blanks that description, warns you and retries, so the tool stays callable. Starting with --worktree now loads plugin WorktreeCreate hooks first, so a plugin can handle worktree creation. Command hooks now stop when their configured timeout runs out. The CLAUDE_CODE_FORCE_SANDBOX environment variable is removed. Passing --sandbox or --no-sandbox to claude remote-control is now an error instead of being silently accepted.
Written by our agent from the shipped bundle, not by Anthropic.
Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH enables the send-file tool without its usual checks, skips uploads and counts the session as remote
ElsewhereAdmin config gains a selfHosted block and a codeAllowedRepositories list for self-hosted sessions; the repo list isn't applied on-device yet
Settings & configSession start can now place a session in a sandbox VM by default, and a new --unsandboxed flag opts out of that and of cloud-by-default
Permissions & safetyThe prompt draft can now tag edits with their origin and report changes, and extensions reach it through composer.attribute and attributeDraft
ExtensionsNew ui.view plugin capability switches the main view to an agent's transcript, and plugin calls judged under an outdated policy are refused
Extensions
CLAUDE_CODE_FORCE_SANDBOX no longer existsPermissions & safetyWant the reasoning? Read walks the 47 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH enables the send-file tool without its usual checks, skips uploads and counts the session as remote
Unclear What Claude Code does with a file in place of uploading it is not stated.
Admin config gains a selfHosted block and a codeAllowedRepositories list for self-hosted sessions; the repo list isn't applied on-device yet
Session start can now place a session in a sandbox VM by default, and a new --unsandboxed flag opts out of that and of cloud-by-default
Unclear It is unclear whether --unsandboxed is a flag users can pass or only an internal entry, and what it does.
The prompt draft can now tag edits with their origin and report changes, and extensions reach it through composer.attribute and attributeDraft
Unclear Which feature these belong to and how an extension reaches them is not known.
New ui.view plugin capability switches the main view to an agent's transcript, and plugin calls judged under an outdated policy are refused
Unclear Whether the plugin system that offers ui.view is available to everyone is not stated.
The organization config schema now lists Claude Code as a third reader, marked not served, and adds a quickWriteEnabled setting
New code can hold a submitted prompt for screening and then rewrite or drop it, with hold details passed through slash commands and ultraplan
Unclear What switches this screening on and where the verdict comes from are not shown.
New permission holds pause tool calls until the user writes, and stop plugin allow verdicts from loosening Cowork cloud web calls
Unclear Nothing shown sets the held state, so it is not clear what turns it on or whether it is in use.
Setting CLAUDE_CODE_MESSAGES_PROMPT_CACHE_TTL to 5m forces the main conversation's prompt cache to last 5 minutes
Unclear What CLAUDE_CODE_MESSAGES_PROMPT_CACHE_TTL actually changes when set is not shown.
New CCR_AGENT_PROXY_RELAY_MODE value agent_proxy_standalone routes all self-hosted session traffic through your own proxy and refuses to start otherwise
Unclear Whether operators set CCR_AGENT_PROXY_RELAY_MODE themselves or it is set for them by the service is not shown.
Plugin mods get a prompt.change event, and permission decisions can now name a setting and a decider
Signed managed-settings checks gain an unanchoredClaims option and return org and account IDs, alongside more restricted-mode handling changes
A separate cloudSessionsOauth sign-in lets Console users reach cloud sessions; logout revokes it, and cloud mode skips local signed caches
Unclear What starts this sign-in, and whether it is switched on for everyone, is not known.
A new check covers one specific tool in a permission mode named arbiter and stays off unless the server turns it on
Unclear What this check turns on or changes when it applies is not clear.
An MCP server can now declare a coordinator as its caller, and memory tool access is then granted at none, some or all levels
Unclear How this is switched on, and whether readers can reach it, is not known.
A new idle compaction mode can swap in a summary written while you were away, off unless it is switched on remotely
Claude Code can ask once per computer whether auto-mode cloud sessions may run commands here without asking each time
Unclear When this question is actually shown has not been confirmed.
Idle compaction gains a mode that summarizes the conversation when you come back, and can skip a ready summary that no longer fits
prompt.change hook fires when something other than you edits the prompt box#The prompt.change hook runs when a plugin or the landing screen changes the prompt box, and stops itself if plugins keep refilling it
Two new admin settings let organizations supply a signed security vendor package that the Cowork workspace installs as root when it starts, on macOS
A new built-in tool scans a mod's folder for keys and tokens before it is shared, asks you first, and reports file names and secret types
Unclear Whether the mod-building plugin, and with it this scan and the sharing offer, is available to ordinary users is not clear.
CLAUDE_CODE_HIDE_REPLY_SERVER_NAME environment variable#Claude Code now recognises an environment variable, CLAUDE_CODE_HIDE_REPLY_SERVER_NAME
Unclear It is not clear what part of the screen CLAUDE_CODE_HIDE_REPLY_SERVER_NAME changes.
The auto-compact window can be set per model under modelSettings, and Claude Code now records which source decided the window in use
The memory dialog has a new option about cloud memory, but it does not change anything shown yet
In a multi-tenant mode, the sandbox uses per-tenant folders and blocks writes to .claude and resume files inside them
Unclear What turns on the multi-tenant mode is not known, so readers cannot tell whether it applies to them.
Gateway, Bedrock, Vertex, OTLP telemetry, attribution and tool policy settings in the shared managed config now list Claude Code as a reader
Unclear It is not confirmed that Claude Code acts on these settings yet, only that they now list it as a reader.
A new connection option can make Claude Code request an MCP server's tool list early on some proxied connections, closing the link if the list stalls
Unclear How the toolsListFirst option gets set is not stated, so it is unclear whether a reader can turn it on.
A new internal SDK message field, text_not_typed, marks text an app or server wrote, and still runs the turn-start attachment pass
A new Claude Desktop admin setting, disableConnectorSignInInApp, keeps sign-in for claude.ai connectors in the system browser
Claude Code has a check that can rule out the arbiter classifier, either because a mode doesn't use it or because its beta is retired
Unclear Where this check is used, and so whether it changes anything a user of auto mode sees, is not known.
In hosted claude-code-server sessions that run without disk storage, Claude Code no longer refreshes MCP sign-in tokens or takes the refresh lock
In coordinator mode with an MCP memory server, Claude Code now skips background memory saving when no suitable tool is visible
Unclear Which tool counts as suitable, and so whether memory saving still runs in a given setup, is not shown.
Claude Code's record of what a model can do now includes whether its thinking is always on
Unclear Which models are marked as having thinking always on is not stated.
When a session uses a tool host interface, Claude Code now adds an extra set of tools to the list sent to Claude
Unclear Which tools are added, and what decides whether they are added, is not stated.
Commands that were limited to claude.ai sign-ins, including /teleport, /remote-env and autofix-pr, now also allow Console-profile sign-ins
Unclear Whether the command's separate on/off check lets console-profile users actually see it is not known.
The managed configuration format gains two fields: configuredHostPath, an absolute macOS or Linux path, and vendorId, a short lower-case name
rewind_conversation accepts allow_assistant_target to rewind to one of Claude's replies and interrupt_if_running to rewind mid-turn
The outcome of an MCP server's task is now saved until the model has read it, and its end notification carries taskKind 'mcp-task'
Third-party model setups can set a minimum Desktop version, and the 1M setting now uses 1M context wherever it's available
Managed settings add microsoftAuthDefaultAccount for silent Microsoft 365 sign-in, and inferenceCredentialKind is now also read by Claude Code
Unclear It is not clear whether Claude Code reads microsoftAuthDefaultAccount or only the Windows desktop app does.
A new managed setting, deniedPluginMcpServers, blocks plugin MCP servers by address, and six more managed settings now list Claude Code as a reader
Unclear It is not confirmed that the Claude Code command-line tool itself enforces these settings, as opposed to them only being listed for it in the desktop settings schema.
Desktop admins can limit Claude.ai import to listed organizations and cap banner dismissals, and automatic3pImport no longer defaults to off
A Console sign-in can now be used to start cloud sessions, with clear errors when it can't be used
Starting a cloud session can now open a browser sign-in for your Console organization instead of requiring a claude.ai login
Unclear It is not clear which accounts or conditions make Claude Code take the Console sign-in route.
Claude Code's terminal renderer gains a text direction setting that marks and right-aligns right-to-left text such as Hebrew or Arabic
Unclear Which terminals or settings make Claude Code switch this handling on is not clear.
claudeCodeProcessWrapperEnabled now covers the 1p scope from desktop version 2.16120.0, not only the 3p scope
A request to run a hook can now set a timeout that replaces the hook's own timeout
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
12 more of these are in What probably matters to you, above.
PreToolUse and PermissionRequest hooks now have input rewrites validated, fail toward refusing or asking, and can't switch mode in some cloud sessions
Unclear Whether a malformed hook change is refused in an interactive session when the remote setting is off, or only recorded, is not settled.
When Read extracts PDF pages it now gives the total page count and next range, and behind a flag oversized PDFs return first pages instead of an error
Claude is now told it can send small artifact changes as edits on publish, and an unclear deploy failure is no longer hidden by a retry
Unclear It is not clear which wording of the edits instruction Claude gets by default.
Whether session hooks and plugin hooks may run now depends on a second mode, with its own allow-list for plugins
Unclear It is not clear what switches on the second mode or whether it is on by default.
Cloud sessions can stage files in place, sort staging failures into permanent and temporary, and stop pushing files once storage is full
Resuming a workflow run can now be refused when its script is hidden, and resume notices show checked, cleaned names, ids and a manual resume call
Command plugins, marketplaces, hooks modules and /goal are held until organization settings are read; an unreadable policy now ends with a clear message
Unclear Which kinds of sessions wait for organization settings in this way is not clear.
Hook selection for organisation-managed setups now includes policy hooks delivered by plugins, and hooks that continue on failure can be marked contested
Unclear What being marked contested changes about whether a hook that continues on failure actually lets the action go ahead is not shown.
Interrupting Claude Code can now stop a running shell command in some cases, where before an interrupt always left the command running
Unclear Which commands are now stopped by an interrupt, for example foreground or background ones, is not shown.
Claude Code's early preparation of a compaction summary can now start while the session is idle, without the usual checks
Unclear It is not clear what starts the idle preparation or whether that path runs for anyone yet.
When creating a cloud session on a self-hosted runner, a mode or effort from your settings is no longer sent, with a notice to use --permission-mode
Cloud-session requests now handle Console-profile sign-ins separately and stop sending the trusted-device header for them
Unclear What decides whether the new Console-profile path for teleport is used is not stated.
The built-in web-fetch helper now uses Haiku when certain model and provider checks pass, and is told not to retry sites that refuse it
Unclear Which model and provider setups qualify for Haiku is not stated.
Claude Code now asks for hooks when it fetches the plugins tied to your account, and reads a new allowManagedModsOnly policy option
Unclear What the allowManagedModsOnly option does is not stated.
A thinking setting of disabled can now be changed to adaptive in some cases, with summarised display
Unclear It is not known when this conversion happens, so it is unclear which sessions get thinking despite a disabled setting.
A signed configuration document is now matched to your logged-in organisation and refused if the signing organisation differs
Unclear Whether a refused document because of an organisation mismatch makes Claude Code exit is not settled.
Finished agent tasks can stay visible while still being viewed, and chat pins and parent links now affect when they are cleared away
Unclear Which finished agents get their removal time pushed back is not stated.
When the agents view opens, background housekeeping can now wait until you have trusted the folder instead of starting straight away
Slash commands you queue while Claude is busy can now be included when queued prompts run together, where before they were always kept out
Unclear What decides whether a queued slash command joins the batch is not shown.
Plugin hooks now run only after an extra admission check, and under managed-hooks-only setups they can be held until the organization answers
Unclear It is not clear what conditions make a plugin hook wait or fail the check, so whether a given plugin's hooks are affected is unsettled.
In a diskless session, Claude Code refuses to move the transcript between project folders and asks for a new design sign-in instead of refreshing it
Claude Code can now attach mentioned files from a supplied list of file paths, not only from @-mentions typed in the prompt
Unclear It is not clear what supplies the separate list of file paths, so when this applies to a reader is unsettled.
In a hosted session, only an organization's settings can place a mod above the user tier, and Claude Code now says so
Plugin helper entries are now held until your organization answers, and the plugin list hides entries whose plugin fails a check
Unclear It is not clear what check decides which plugin entries are hidden.
Claude Code now has text explaining who changes the sandbox's allowed hosts, depending on your plan
Hooks that run on another machine now report timing out separately from failing, and organization hooks no longer start with a plugin's environment
If link requests are switched off, an MCP task that asks for input by link is now cancelled instead of being handled
Plugin command sources and marketplace headersHelper commands no longer run in a tool server and wait until organization settings have loaded
A hooks module that was approved under a different policy text than the one now in force is skipped instead of run
Workflow agents can start with a rewritten prompt that gets its own check, and handing a workflow back to a dontAsk session adds a warning
In the desktop app and on claude.ai, a browser request with no extension connected can get a fixed setup reply instead of a model answer
When an MCP server's reply does not say whether a publish happened, Claude Code now raises a specific error
Unclear Which feature this publish belongs to, and whether it can be reached yet, is not known.
MCP task endings are saved before notifying so a restart keeps them, with new needs_sign_in and answered_with_errors ending reasons
Rewind can fall back to an assistant message, and it removes queued prompts and saved MCP task endings left by the rewound turn
Unclear It is not clear whether any rewind action in this release actually switches the new option on.
Permission prompts in ask mode no longer always hide 'always allow'; that now depends on the tengu_valiant_crayon switch
Unclear It is not clear which condition decides whether ask mode still hides the option.
Two new env vars cap how many PDF pages Claude reads per message and per turn after the context has filled once
Unclear It is not clear what sets the enabled-and-enforced state, so setting the variables alone may not turn the limit on.
Hook input now leaves transcript_path blank whenever a certain check holds, and agent hooks are no longer told to ignore that field
Unclear Which kinds of session the condition covers is not known.
A set_permission_mode request can now carry from_settings, and a runner child ignores settings-supplied modes and keeps its own
Unclear It does not say what makes a Claude Code process a runner child, so it is unclear which setups now lose a mode from settings.
allowedPluginMcpServers is now marked as read by Claude Code, and network endpoint lists now drop entries meant for other platforms
Users with a one-million-token context can be offered a choice of when auto-compact kicks in, from 300k to 900k tokens
Interaction and tool spans in OpenTelemetry traces now include standard gen_ai attributes, and the recorded prompt can be redacted afterwards
In non-interactive sessions, plugin install now settles before session-start hooks run again, and CLAUDE_CODE_SYNC_PLUGIN_INSTALL waits for pending installs
Unclear Exactly how startup timing changes for a headless session is not clear.
When a message is only pasted text, Claude treats the paste as your request, but still ignores instructions buried inside pasted documents
claude remote-control now asks up front about serving a folder unattended and fails on --sandbox, --no-sandbox or a sandbox config key
Claude Code's git watcher now recognises repositories using the reftable format, so branch and commit changes are picked up there
On Linux, Claude Code now refuses to write a file whose path looks like a Mac or Windows user path, and nothing is written
When an MCP server refuses sign-in while Claude Code checks on a long task, checking stops with a message saying the poll was refused
In automatic tool search mode, once a conversation has set up tool search it stays enabled instead of being rechecked against the usage threshold each time
If a URL failed earlier in the session, WebFetch skips a quick second attempt and tells the model to say the page could not be read
Claude Code now skips your AWS auth refresh command in certain situations, reports it as failed and logs a reason
Unclear It is not clear which situations stop the AWS refresh command from running.
Claude Code now leaves some failed or needs-auth MCP servers out of the model's lists, and the app's own server failures get fixed wording
Skill shell commands meant for tools other than Bash can now be rejected, and skill descriptions go through a normaliser
Unclear It is not clear which commands the new check rejects or when a skill's allowed tools list ends up empty.
Published verbatim by Anthropic for v2.1.300. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 88 bullets, 18 name something an entry on this page also names, 28 name something no entry here does, and 42 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
virtualText to a mod's prompt decorations: text drawn in the prompt box that never enters the draft or the submitted prompt
No entry names this cache_creation_5m_tokens and cache_creation_1h_tokens to the OpenTelemetry api_request event, splitting cache writes by lifetime
Probably cache-creation-5m1h-token-split-in-api-telemetry $.ui.view({ agentId }) for mods: shows an agent's transcript in the main view when you ask, and $.ui.view({}) goes back
No entry names this dir prop on a mod's Text for right-to-left text: on Windows and in VS Code's terminal its rows read in that direction and sit flush right
No entry names this /advisor on Claude Platform on AWS; no advisor runs until you pick one with /advisor, advisorModel or --advisor, and CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns it off
No entry names this gen_ai.provider.name, gen_ai.conversation.id, gen_ai.tool.name and error.type
Probably tool-error-span-attribute-for-failed-non-interrupted-tool-c, otel-spans-get-gen-ai-attributes-prompt-redaction-handle, tool-and-llm-telemetry-spans-gain-gen-ai-attributes prompt and model in the agent.spawn mod hook, which could only refuse workflow agents before
No entry names this prompt.change mod hook, raised when the prompt box's text changes without a typed edit: a recalled history entry, a clear, an undo, or a plugin's fill
Probably new-telemetry-and-event-names, mod-event-table-gains-promptchange-policy-decision-gets-se, prompt-change-hook-dispatcher-with-loop-stall-guard /autocompact warning about high token usage when you choose a smaller auto-compact window
Probably autocompact-telemetry-expanded-and-the-high-token-warning-m claude --help naming a removed tool in its description of --restricted
Probably restricted-help-text-no-longer-names-repl claude agents not refreshing any pull request's status when the data for one of them came back incomplete
No entry names this /tasks shortly after finishing, leaving no way back to the conversation
No entry names this ENABLE_TOOL_SEARCH=auto) turning off part-way through a conversation, for example while MCP servers reconnect after a resume
No entry names this forceLoginOrgUUID leaving the refused organization's token stored, or live after /login
Probably remote-control-credential-renewal-explains-sign-in-failures, cloud-agents-not-logged-in-error-can-carry-a-custom-message, oauth-login-paths-gain-an-org-pin-verification-step-before-c, forceloginorguuid-check-refactored-with-a-reusable-verifier, cloud-session-creation-has-a-separate-console-profile-path Artifact("(unprintable path)") while a call's input arrives; its row now shows "Waiting…" and "Running…" as Bash's does
No entry names this /branch dropping messages, and claude purge skipping subfolder projects, when they contain a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this WorktreeCreate and WorktreeRemove hooks not running when Claude Code starts with --worktree (not yet with --tmux)
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work #100905[BUG] Plugin `WorktreeCreate` hook still ignored for `claude --worktree` on 2.1.296 (#46664 closed as stale, never fixed) Open
tool_result events missing git_commit_id after git commit -q in repositories using reftable ref storage
No entry names this prompt.submit hook rewrote or dropped still being recorded as typed in the OpenTelemetry user_prompt event and interaction span, and in session title requests
Probably user-prompt-telemetry-helper-and-orphan-answer-skip-flag-att, userpromptsubmit-hook-detection-restricted-by-a-new-module-c, mod-event-table-gains-promptchange-policy-decision-gets-se model: aliases like haiku now resolve, a subagent's model no longer overrides it, and an unavailable model falls back to the caller's instead of allowing the action
Nothing to match on --worktree sessions sometimes starting from the wrong commit when a tag or branch was named like a commit ID, and their starting git status naming a branch other than the new worktree's
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work --worktree failing to reopen a worktree in repositories using git's reftable ref storage
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work #96060[BUG] Reftable repos: CLI reads .git/HEAD directly, branch resolves to ".invalid" and PR status is dropped from the statusLine payload Open
claude remote-control servers giving up on renewing their connection after a brief sign-in error, such as a locked keychain; they now retry, and warn when you need to run claude /login
Probably remote-control-credential-renewal-explains-sign-in-failures, cloud-agents-not-logged-in-error-can-carry-a-custom-message, remote-control-asks-about-unattended-tool-calls-up-front-in, remote-control-rejects-sandbox-no-sandbox-instead-of-acc, cloud-session-creation-has-a-separate-console-profile-path #95262remote-control session permanently 401s after token refresh fails; /login cannot reach the process Open
--worktree failing in a worktree of a bare repository when origin's default branch can't be fetched; the fallback base is now the current checkout's HEAD, not the main repository's
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work prompt.edit hook not being raised for a newline entered with the chat:newline keybinding (Ctrl+J, or a rebound Enter)
No entry names this claude daemon stop --any printing "stopped" while a stuck background service kept running: it now waits, force-kills the service, and says so with exit 1 if it is still there
No entry names this claude daemon stop exiting with no output, and leaving sessions listed as running, when telemetry is turned off
Probably daemon-stop-now-escalates-sigterm-to-sigkill-and-explains-st /healthz or SIGTERM shutdown) while nobody reads their output; logs keep the latest 256 KiB and count drops (not on Windows)
No entry names this plugin-authoring skill: Claude scans a mod's files for keys before opening them, and asks before scanning a folder outside the project
Probably secret-scan-tool-for-the-plugin-authoring-mods-built-in-pl CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST sessions to ignore CA-bundle, tool-proxy, git TLS and git config variables like SSL_CERT_FILE in settings; under Claude Desktop, only in project settings
No entry names this forceLoginGatewayUrl names an Anthropic-operated gateway that serves the session's hostname; that gateway must be reachable at start
No entry names this claude gateway to stop at start, naming the key, on a desktop: policy key that Claude Desktop cannot use from a gateway, where it earlier started with a warning
No entry names this CLAUDE_CODE_GZIP_REQUEST_BODIES=0 to turn it off
No entry names this claude-api skill to leave Managed Agents sessions in place unless you ask to archive or delete them
No entry names this /sandbox mode options to read "Sandbox commands" instead of "Sandbox BashTool"
Probably sandbox-option-label-renamed, sandbox-menu-labels-renamed PermissionRequest hooks in Cowork cloud sessions: a setMode update in a hook's allow is now ignored; the rest of the approval still applies
Probably hook-updatedinput-rewrites-are-now-validated-against-the-too, managed-settings-startup-message-distinguishes-unloaded-hook, permissionrequest-hook-setmode-dropped-in-cowork-cloud-cod, hook-load-failures-a-managed-settings-hook-that-cant-be-lo updatedInput from PreToolUse and PermissionRequest hooks is now validated like Claude's own input: unknown keys are dropped, and input the tool rejects denies the call
Probably hook-updatedinput-rewrites-are-now-validated-against-the-too, updatedinput-refusal-message-varies-by-settings-source --sandbox and --no-sandbox flags from claude remote-control, which had no effect; passing either now exits with an error. Set sandbox.enabled in settings to sandbox sessions
Probably remote-control-asks-about-unattended-tool-calls-up-front-in, remote-control-rejects-sandbox-no-sandbox-instead-of-acc, gateway-inference-settings-are-now-read-by-claude-code-cod claudeCode.attachSelection setting to stop text selected in the editor from being added to your messages
No entry names this /c:/… path instead of a mention relative to the working directory
No entry names this /bin/ps directly instead of searching PATH for ps on every check
No entry names this @claude review comments from people with write access whose GitHub organization membership is private; their comments now start a review
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 27 tool descriptions changed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
647 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?